ClickOnce - Anomalous Package Writes in Apps/2.0 Cache (T1105)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•2

Detects newly written executables within the per-user ClickOnce cache directory that lack valid digital signatures. This rule specifically looks for file creation events of executable files (.exe) in the `AppData\Local\Apps\2.0\` directory, excluding creations initiated by `msiexec.exe` or `explorer.exe`.